Project Introduction

This is a tool written in Go for generating POC for the CVE-2023-38831 vulnerability

Affected version: WinRAR <6.23

How to use?

Compile

go build cve-2023-38831.go

Usage

cve-2023-38831.exe 1234.jpg payload.cmd poc.zip

Here, 1234.jpg can be the result of any file modification. I directly used 1234.jpg, but you can also use readme.md and other files that are more likely to attract user clicks.

payload.cmd can also be a payload.bat file, which is the command we want to execute this time. I directly used the calculator command

start calc

Finally, poc.zip is the input compressed file. It can also be a .rar or other extensions, users can test other extensions themselves.

Successfully popped calculator

The WinRAR version I used is